chore(sync): merge Silo-Server/silo-android main (168 commits)

.superpowers/sdd/2026-07-27-pr108-slice-f-watch-together/task-1-report.md

@@ -45,7 +45,7 @@ owner-driven cancellation remains silent.
 ### Credential boundary
 
 The access token is still required to attempt the room socket but is no longer
-placed in the request target. The existing same-origin Silo auth plugin adds
+placed in the request target. The existing same-origin Prairie auth plugin adds
 `Authorization`, `X-Profile-Id`, and `X-Profile-Token` headers. The server
 currently still requires `room_token`, `profile_id`, and `profile_token` query
 parameters; the client KDoc records that residual request-target exposure.
@@ -213,9 +213,9 @@ The exact-scope validation at connect start is not the final token read: the
 auth plugin reads the scoped token again while building the request so it can
 honor rotation. A credential scope can disappear between those reads. The
 Watch Together connector now marks its pinned request with the internal,
-opt-in `requireSiloAuth()` attribute. When that marked request's exact scoped
-token is null or blank, `PrairieAuthPlugin` removes Silo headers and throws before
-the engine runs. Unmarked public requests and `skipSiloAuth()` paths retain
+opt-in `requirePrairieAuth()` attribute. When that marked request's exact scoped
+token is null or blank, `PrairieAuthPlugin` removes Prairie headers and throws before
+the engine runs. Unmarked public requests and `skipPrairieAuth()` paths retain
 their existing behavior.
 
 ### Correction 2 TDD evidence

.superpowers/sdd/2026-07-28-android-tv-active-header-focus-editorial-hero/task-4-report.md

@@ -0,0 +1,172 @@
+# Task 4 Report: Android TV Focus and Phone/TV Hero Verification
+
+Date: 2026-07-28
+Worktree: `fix/tv-for-you-cold-navigation worktree`
+Final local HEAD: `9c251293dc321385ea9be205a0732cc7b14b1251`
+
+## Summary
+
+Task 4 verification found one Important review issue in the previously approved Task 1 focus path. I fixed it locally in `9c251293` by preventing non-Search secondary routes from falling through to Home focus when `selectedRoot == null`. The repeat independent review approved the updated diff.
+
+Automated tests, supply-chain checks, release builds, APK signing verification, and artifact packaging completed. Dedicated emulator smoke did not produce a fully clean pass, so I did not push or update PR #126.
+
+## Local Commits Added
+
+- `9c251293 fix(tv): avoid home focus fallback on secondary routes`
+
+## Verification Commands
+
+Focused TV regressions:
+
+```bash
+./gradlew :androidTvApp:testDebugUnitTest \
+  --tests "org.prairieserver.prairie.tv.ui.shell.TvTopMenuFocusRequestTest" \
+  --tests "org.prairieserver.prairie.tv.ui.shell.TvShellFocusStateTest" \
+  --tests "org.prairieserver.prairie.tv.ui.components.TvSkylineUpNavigationTest" \
+  --tests "org.prairieserver.prairie.tv.ui.components.TvFocusMarqueeModelTest" \
+  --rerun-tasks --max-workers=2 --no-daemon
+```
+
+Result: `BUILD SUCCESSFUL`, 68 tasks executed.
+
+Focused phone regression:
+
+```bash
+./gradlew :androidApp:testDebugUnitTest \
+  --tests "org.prairieserver.prairie.android.ui.screens.home.FeaturedHeroMetadataTest" \
+  --rerun-tasks --max-workers=2 --no-daemon
+```
+
+Result: `BUILD SUCCESSFUL`, 80 tasks executed.
+
+Supply-chain checks:
+
+```bash
+./scripts/test-check-build-supply-chain.sh
+./scripts/check-build-supply-chain.sh
+```
+
+Result: both exited 0. Self-test output: `All supply-chain policy self-tests passed`.
+
+Full release gate:
+
+```bash
+./gradlew \
+  :androidApp:testDebugUnitTest \
+  :androidTvApp:testDebugUnitTest \
+  :androidApp:assembleRelease \
+  :androidTvApp:assembleRelease \
+  -PallowDebugReleaseSigning=true \
+  --rerun-tasks --max-workers=2 --no-daemon
+```
+
+Result: `BUILD SUCCESSFUL in 6m 29s`, 313 tasks executed.
+
+The test XML directory immediately after the full release gate only contained focused suites, so I reran the unfiltered unit-test tasks explicitly:
+
+```bash
+./gradlew :androidApp:testDebugUnitTest :androidTvApp:testDebugUnitTest \
+  --rerun-tasks --max-workers=2 --no-daemon
+```
+
+Result: `BUILD SUCCESSFUL in 1m 20s`, 104 tasks executed.
+
+XML totals after explicit unfiltered rerun:
+
+- `androidApp/build/test-results/testDebugUnitTest`: 85 suites, 477 tests, 0 skipped, 0 failures, 0 errors.
+- `androidTvApp/build/test-results/testDebugUnitTest`: 88 suites, 646 tests, 0 skipped, 0 failures, 0 errors.
+
+Diff hygiene:
+
+```bash
+git diff --check origin/main...HEAD
+git status --short --branch
+git log --oneline origin/main..HEAD
+```
+
+Result before writing this report: no whitespace errors; branch ahead of `origin/fix/tv-for-you-cold-navigation`.
+
+## Independent Review
+
+Initial review finding:
+
+- Important: non-Search secondary routes could call `requestMenuFocus(null)` and fall through to Home in `TvTopMenuBar`.
+
+Fix:
+
+- Added `TvShellFocusState.requestMenuFocusIfAvailable`.
+- Updated content-Up routing in `TvMainShell` to allow null targeting only for Search.
+- Added regression coverage in `TvShellFocusStateTest`.
+
+Repeat review result:
+
+- No blocking findings. Approved.
+- Residual risk noted by reviewer: the content-Up fix is covered by state/helper unit tests, not a full Compose focus integration test.
+
+## Emulator Smoke
+
+Physical device safety:
+
+- ADB showed an unapproved physical TV device; I did not target it.
+- TV smoke used the dedicated TV emulator.
+- Phone smoke used the dedicated phone emulator.
+
+TV smoke on final TV APK:
+
+- Installed `androidTvApp/build/outputs/apk/release/androidTvApp-universal-release.apk`
+  on the dedicated TV emulator.
+- Home: from content card, fresh Up focused the Home top pill. Pass.
+- Movies library: from first content card, first Up left focus on the content card; second Up focused the Movies pill. Not a clean pass.
+- For You: from content, fresh Up focused the For You control. Pass.
+- Calendar: targeted Calendar and entered content; Up focused the in-page `Following` control rather than the top Calendar pill. Not a clean top-pill pass.
+- Hold-Up from lower row: not cleanly completed after the caveats above.
+- Search route focus: not completed after the caveats above.
+- TV hero metadata: visual/UIAutomator dumps showed editorial hero metadata for focused content and no technical badges in the large hero; content cards still show technical badges outside the hero.
+
+Phone smoke on final phone APK:
+
+- Installed `androidApp/build/outputs/apk/release/androidApp-universal-release.apk`
+  on the dedicated phone emulator.
+- Opened Libraries > Movies. The Movies library Recommended hero displayed editorial chips `2004`, `7.3`, `War`, `R`, with no generic `Movie` chip, and Play / More Info visible.
+- The selected movie did not show a runtime chip in the UIAutomator dump, so the requested movie smoke is partial rather than a full pass.
+- Episode carousel page smoke was not completed.
+- Narrow viewport wrapping was not completed beyond the default `1080x2400` phone emulator viewport.
+
+Smoke conclusion: not fully green. PR #126 was not pushed or updated.
+
+## APK Artifacts
+
+Built universal minified release APKs from local HEAD `9c251293` with `-PallowDebugReleaseSigning=true`.
+
+Signing caveat: these are debug-signed release builds. They only upgrade installations signed with the same debug certificate.
+
+Copied artifacts:
+
+- `Prairie-Phone-Universal-0.3.11-FocusHeroFix-9c251293.apk`
+- `Prairie-TV-Universal-0.3.11-TVFocusHeroFix-9c251293.apk`
+
+SHA-256:
+
+- Phone: `0c4c68d15d47c28de41ef1fc1db080ba266f899aa2c3dad663a20fdb5dd5ed50`
+- TV: `9e135e3cdad20f1b000ae2ef55573ceb6070e1412718d4ebde47a1977e492a09`
+
+`apksigner verify --verbose` on copied APKs:
+
+- Phone: verifies; v2 scheme true; number of signers 1.
+- TV: verifies; v2 scheme true; number of signers 1.
+
+`apkanalyzer` status:
+
+- `apkanalyzer` failed with `IllegalStateException: Cannot locate latest build tools`, even with `ANDROID_HOME` and `ANDROID_SDK_ROOT` set.
+- Used SDK `aapt` as fallback for package/version/ABI metadata.
+
+`aapt dump badging` metadata:
+
+- Phone: `applicationId=org.prairieserver.prairie`, `versionCode=14`, `versionName=0.3.11`, native ABIs `arm64-v8a, armeabi-v7a, x86, x86_64`.
+- TV: `applicationId=org.prairieserver.prairie`, `versionCode=15`, `versionName=0.3.11`, native ABIs `arm64-v8a, armeabi-v7a, x86, x86_64`.
+
+## PR Status
+
+No push performed.
+
+No PR #126 description update performed because the required emulator smoke was not fully green.

android-shared/build.gradle.kts

@@ -130,7 +130,8 @@ kotlin {
 android {
     namespace = "org.prairieserver.prairie.common"
     compileSdk = 36
-    sourceSets.getByName("debug").assets.srcDir("$projectDir/schemas")
+    // Room migration schemas are local-test fixtures shared by both build variants.
+    sourceSets.getByName("test").assets.srcDir("$projectDir/schemas")
     defaultConfig {
         minSdk = 24
         // Gate for preferring FFmpeg audio decoders over platform decoders.

android-shared/src/androidMain/kotlin/org/prairieserver/prairie/common/data/repository/RoomCatalogCacheRepository.kt

@@ -1,6 +1,6 @@
 package org.prairieserver.prairie.common.data.repository
 
-import org.prairieserver.prairie.common.data.db.PrairieDatabase
+import org.prairieserver.prairie.common.data.db.SiloDatabase
 import org.prairieserver.prairie.common.data.db.entity.CatalogCacheEntity
 import org.prairieserver.prairie.model.catalog.CatalogResponse
 import org.prairieserver.prairie.model.catalog.EpisodesResponse
@@ -9,7 +9,10 @@ import org.prairieserver.prairie.model.catalog.SeasonsResponse
 import org.prairieserver.prairie.model.personal.UserLibrary
 import org.prairieserver.prairie.model.section.ResolvedSection
 import org.prairieserver.prairie.network.AuthScopeSnapshot
+import org.prairieserver.prairie.network.DefaultIdentityTransitionBarrier
+import org.prairieserver.prairie.network.IdentityTransitionBarrier
 import org.prairieserver.prairie.repository.port.CatalogCachePort
+import org.prairieserver.prairie.repository.port.CatalogCacheWriteLease
 import kotlinx.serialization.json.Json
 
 /**
@@ -19,53 +22,94 @@ import kotlinx.serialization.json.Json
  * rather than crashing the browse screen.
  */
 class RoomCatalogCacheRepository(
-    db: PrairieDatabase,
+    db: SiloDatabase,
     private val snapshotProvider: suspend () -> AuthScopeSnapshot?,
+    private val identityTransitions: IdentityTransitionBarrier = DefaultIdentityTransitionBarrier(),
     private val now: () -> Long = { System.currentTimeMillis() },
 ) : CatalogCachePort {
 
     private val dao = db.catalogCacheDao()
     private val json = Json { ignoreUnknownKeys = true }
 
     override suspend fun cacheLibraries(libraries: List<UserLibrary>) =
-        put(KEY_LIBRARIES, json.encodeToString(libraries))
+        cacheLibraries(libraries, currentWriteLease())
+
+    override suspend fun cacheLibraries(libraries: List<UserLibrary>, lease: CatalogCacheWriteLease) =
+        put(KEY_LIBRARIES, json.encodeToString(libraries), lease)
 
     override suspend fun getCachedLibraries(): List<UserLibrary>? =
         get(KEY_LIBRARIES)?.let { runCatching { json.decodeFromString<List<UserLibrary>>(it) }.getOrNull() }
 
     override suspend fun cacheDefaultLibraryPage(libraryId: Int, response: CatalogResponse) =
-        put(libraryKey(libraryId), json.encodeToString(response))
+        cacheDefaultLibraryPage(libraryId, response, currentWriteLease())
+
+    override suspend fun cacheDefaultLibraryPage(
+        libraryId: Int,
+        response: CatalogResponse,
+        lease: CatalogCacheWriteLease,
+    ) = put(libraryKey(libraryId), json.encodeToString(response), lease)
 
     override suspend fun getCachedDefaultLibraryPage(libraryId: Int): CatalogResponse? =
         get(libraryKey(libraryId))?.let { runCatching { json.decodeFromString<CatalogResponse>(it) }.getOrNull() }
 
     override suspend fun cacheLibrarySections(libraryId: Int, sections: List<ResolvedSection>) =
-        put(librarySectionsKey(libraryId), json.encodeToString(sections))
+        cacheLibrarySections(libraryId, sections, currentWriteLease())
+
+    override suspend fun cacheLibrarySections(
+        libraryId: Int,
+        sections: List<ResolvedSection>,
+        lease: CatalogCacheWriteLease,
+    ) = put(librarySectionsKey(libraryId), json.encodeToString(sections), lease)
 
     override suspend fun getCachedLibrarySections(libraryId: Int): List<ResolvedSection>? =
         get(librarySectionsKey(libraryId))?.let { runCatching { json.decodeFromString<List<ResolvedSection>>(it) }.getOrNull() }
 
     override suspend fun cacheItemDetail(contentId: String, detail: ItemDetail) =
-        put(itemDetailKey(contentId), json.encodeToString(detail))
+        cacheItemDetail(contentId, detail, currentWriteLease())
+
+    override suspend fun cacheItemDetail(
+        contentId: String,
+        detail: ItemDetail,
+        lease: CatalogCacheWriteLease,
+    ) = put(itemDetailKey(contentId), json.encodeToString(detail), lease)
 
     override suspend fun getCachedItemDetail(contentId: String): ItemDetail? =
         get(itemDetailKey(contentId))?.let { runCatching { json.decodeFromString<ItemDetail>(it) }.getOrNull() }
 
     override suspend fun cacheSeasons(seriesId: String, response: SeasonsResponse) =
-        put(seasonsKey(seriesId), json.encodeToString(response))
+        cacheSeasons(seriesId, response, currentWriteLease())
+
+    override suspend fun cacheSeasons(
+        seriesId: String,
+        response: SeasonsResponse,
+        lease: CatalogCacheWriteLease,
+    ) = put(seasonsKey(seriesId), json.encodeToString(response), lease)
 
     override suspend fun getCachedSeasons(seriesId: String): SeasonsResponse? =
         get(seasonsKey(seriesId))?.let { runCatching { json.decodeFromString<SeasonsResponse>(it) }.getOrNull() }
 
     override suspend fun cacheEpisodes(seriesId: String, seasonNumber: Int, response: EpisodesResponse) =
-        put(episodesKey(seriesId, seasonNumber), json.encodeToString(response))
+        cacheEpisodes(seriesId, seasonNumber, response, currentWriteLease())
+
+    override suspend fun cacheEpisodes(
+        seriesId: String,
+        seasonNumber: Int,
+        response: EpisodesResponse,
+        lease: CatalogCacheWriteLease,
+    ) = put(episodesKey(seriesId, seasonNumber), json.encodeToString(response), lease)
 
     override suspend fun getCachedEpisodes(seriesId: String, seasonNumber: Int): EpisodesResponse? =
         get(episodesKey(seriesId, seasonNumber))?.let { runCatching { json.decodeFromString<EpisodesResponse>(it) }.getOrNull() }
 
-    private suspend fun put(cacheKey: String, jsonStr: String) {
+    private suspend fun put(
+        cacheKey: String,
+        jsonStr: String,
+        lease: CatalogCacheWriteLease,
+    ) {
+        if (lease.identityGeneration != identityTransitions.generation.value) return
         val snapshot = snapshotProvider() ?: return
         val profileId = snapshot.profileId ?: return
+        if (lease.identityGeneration != identityTransitions.generation.value) return
         // A Room row must fit SQLite's ~2MB CursorWindow or the *read* throws
         // SQLiteBlobTooBigException. Big library pages can exceed it, so don't
         // store an unreadable row — drop any prior row for this key and skip.
@@ -84,6 +128,9 @@ class RoomCatalogCacheRepository(
         )
     }
 
+    private fun currentWriteLease() =
+        CatalogCacheWriteLease(identityTransitions.generation.value)
+
     private suspend fun get(cacheKey: String): String? {
         val snapshot = snapshotProvider() ?: return null
         val profileId = snapshot.profileId ?: return null

android-shared/src/androidMain/kotlin/org/prairieserver/prairie/common/data/repository/RoomHomeCacheRepository.kt

@@ -1,11 +1,14 @@
 package org.prairieserver.prairie.common.data.repository
 
-import org.prairieserver.prairie.common.data.db.PrairieDatabase
+import org.prairieserver.prairie.common.data.db.SiloDatabase
 import org.prairieserver.prairie.common.data.db.entity.HomeCacheEntity
 import org.prairieserver.prairie.model.section.ResolvedSection
 import org.prairieserver.prairie.network.AuthScopeSnapshot
+import org.prairieserver.prairie.network.DefaultIdentityTransitionBarrier
+import org.prairieserver.prairie.network.IdentityTransitionBarrier
 import org.prairieserver.prairie.repository.port.HomeCachePort
 import org.prairieserver.prairie.repository.port.HomeCacheSnapshot
+import org.prairieserver.prairie.repository.port.HomeCacheWriteLease
 import kotlinx.serialization.json.Json
 
 /**
@@ -17,17 +20,30 @@ import kotlinx.serialization.json.Json
  * JSON decodes to null rather than crashing the home screen.
  */
 class RoomHomeCacheRepository(
-    db: PrairieDatabase,
+    db: SiloDatabase,
     private val snapshotProvider: suspend () -> AuthScopeSnapshot?,
+    private val identityTransitions: IdentityTransitionBarrier = DefaultIdentityTransitionBarrier(),
     private val now: () -> Long = { System.currentTimeMillis() },
 ) : HomeCachePort {
 
     private val dao = db.homeCacheDao()
     private val json = Json { ignoreUnknownKeys = true }
 
     override suspend fun cacheHome(sections: List<ResolvedSection>) {
+        cacheHome(
+            sections = sections,
+            lease = HomeCacheWriteLease(identityTransitions.generation.value),
+        )
+    }
+
+    override suspend fun cacheHome(
+        sections: List<ResolvedSection>,
+        lease: HomeCacheWriteLease,
+    ) {
+        if (lease.identityGeneration != identityTransitions.generation.value) return
         val snapshot = snapshotProvider() ?: return
         val profileId = snapshot.profileId ?: return
+        if (lease.identityGeneration != identityTransitions.generation.value) return
         val sectionsJson = json.encodeToString(sections)
         // A Room row must fit SQLite's ~2MB CursorWindow or the *read* throws
         // SQLiteBlobTooBigException. Large reorganized home layouts can exceed

android-shared/src/androidMain/kotlin/org/prairieserver/prairie/common/di/PlayerInfraModule.kt

@@ -71,6 +71,10 @@ val playerInfraModule = module {
         DefaultServerSettingsFlusher(
             settingsApi = get(),
             scope = CoroutineScope(SupervisorJob() + Dispatchers.IO),
+            // Same source the settings store stamps its ops with, so a
+            // retained retry can tell whether the server it was authored
+            // against is still the one requests would reach.
+            getServerUrl = { get<TokenManager>().getServerUrl() },
         )
     }